CVE-2026-53174: Linux Kernel Overlay Filesystem Directory Enumeration Error

Technical summary

The vulnerability exists in the Linux kernel's overlay filesystem code path for merged directory iteration. In ovl_iterate_merged(), the function calls ovl_cache_get() and immediately assigns the returned value to err via PTR_ERR(cache) without first checking IS_ERR(cache). On successful cache retrieval, this assignment places a truncated pointer value into the err variable, which is then propagated back to the caller as a bogus non-zero error code. The call chain can be triggered through nested overlay-on-overlay readdir operations: a getdents64() call on an outer overlay file triggers ovl_iterate_merged(), which calls ovl_cache_get() to merge directories, and if the outer overlay contains an inner overlay, the inner overlay's ovl_iterate_merged() is invoked recursively, amplifying the issue. The fix requires computing PTR_ERR(cache) only on the error path, after IS_ERR(cache) validation has determined that an actual error condition exists.

Business impact

This vulnerability can degrade the reliability of directory operations on systems using overlay filesystems, particularly in containerized environments where nested overlays are common (Docker, Kubernetes). Applications that enumerate directories and expect consistent behavior may encounter spurious POSIX errors, leading to failed file discovery, application crashes, or operational degradation. For organizations running container infrastructure or using overlay-based storage for performance isolation, this bug introduces a source of unpredictable failures that can complicate troubleshooting and reduce system dependability. The impact is localized to local unprivileged users, so remote exploitation is not possible, but insider threats or compromised containers can weaponize the issue to disrupt workload stability.

Affected systems

All versions of the Linux kernel that include the overlay filesystem implementation are potentially affected. The vulnerability requires local access and unprivileged user privileges to trigger, so exposure is limited to systems where untrusted users have shell access or where container workloads can execute arbitrary code. Systems heavily dependent on overlay filesystems—including Linux distributions shipping recent kernel versions, containerized environments, and systems using overlay-based storage backends—carry the highest risk. Verify the specific kernel version and overlay filesystem patches in your distribution's advisory for precise affected version ranges.

Exploitability

Exploitation requires local access and the ability to execute code as an unprivileged user. The attack is straightforward: trigger a nested overlay-on-overlay readdir operation to hit the buggy code path and receive a false error response. The bug does not grant elevated privileges or enable information disclosure beyond what the unprivileged user already has access to; its primary impact is denial of service via directory enumeration failures. No special hardware, tools, or kernel configuration is required beyond the ability to create and interact with nested overlay filesystems, which is possible in standard containerized environments. The CVSS 7.8 HIGH score reflects the local-only access requirement and privilege escalation potential in limited scenarios, but this is not a straightforward privilege escalation vector.

Remediation

Update the Linux kernel to a patched version released by your distribution. Kernel maintainers have addressed this issue by restructuring ovl_iterate_merged() to compute PTR_ERR(cache) only after IS_ERR(cache) validation confirms an error condition. Obtain the specific patched kernel version from your distribution's security advisory or kernel.org. Until patching is possible, mitigate by restricting unprivileged access to overlay filesystem mount points or disabling overlay filesystem use if not operationally required. For container environments, update container runtime versions that bundle patched kernel modules or use a base OS image with the patched kernel.

Patch guidance

Contact your Linux distribution vendor (Red Hat, Canonical, SUSE, etc.) or monitor kernel.org security announcements for the specific patched kernel version addressing CVE-2026-53174. Patches typically target stable kernel branches (e.g., 6.x LTS, 5.x LTS). Verify the patch commit message references 'ovl_iterate_merged()' and 'PTR_ERR(cache)' to confirm the fix is included. Test patched kernels in a staging environment before production rollout, particularly if your workloads depend on overlay filesystems. Reboot systems to activate the patched kernel; overlay filesystem mount operations will use the corrected code immediately upon kernel load.

Detection guidance

Monitor system logs for directory enumeration failures (POSIX error codes returned by getdents64, opendir, readdir calls) occurring on overlay filesystem mount points, especially in nested overlay scenarios. Correlate spurious readdir failures with unprivileged user activity or container workload restarts. Use strace or auditd to capture readdir syscall failures on suspect filesystems. Deploy kernel tracing (eBPF or kprobes) to instrument ovl_iterate_merged() and observe err values to identify instances where non-zero values are returned despite successful cache retrieval. File integrity monitoring tools may report false positive changes if applications retry failed directory operations, so tune detection rules accordingly. Container runtime logs may show application-level directory enumeration failures as indirect evidence of the kernel bug.

Why prioritize this

CVE-2026-53174 rates HIGH priority for organizations running Linux with overlay filesystems and unprivileged user access. The combination of moderate exploitability (local access required), significant operational impact (directory operation failures in containers/overlays), and broad exposure (common in modern container infrastructure) justifies rapid patch deployment. Organizations with minimal overlay filesystem use or isolated unprivileged user access can deprioritize relative to other critical vulnerabilities, but container-native organizations should treat this as high priority. The non-critical CVSS vector and lack of KEV status should not reduce vigilance—reliability degradation in containerized workloads carries downstream business costs.

Risk score, explained

CVSS 7.8 (HIGH) reflects a local-only attack vector, low complexity, and requirement for unprivileged user privileges, offset by high impact on confidentiality, integrity, and availability. The score assumes an environment where untrusted users can interact with overlay filesystems. In contexts with strong user isolation, the risk is lower; in container environments with shared kernel namespaces, the risk approaches the scored level. The score does not account for business context (container criticality, workload sensitivity) or attack likelihood, which should be assessed during risk prioritization.

Frequently asked questions